CVE-2024-38949

What it actually does

Heap buffer overflow in the display444as420 function of libde265 allows a crafted input to trigger memory corruption that crashes the process.

Why it matters to the business

Video decoding or playback applications using the library become unavailable after processing malicious content, causing service disruption for media workflows that rely on HEVC streams.

How an attack unfolds

An attacker crafts a malicious video payload that reaches the display444as420 function when rendered or decoded by an affected application; the overflow occurs on the heap and immediately terminates the process.

How to fix it

Upgrade libde265 to a version that resolves the overflow; on the listed Ubuntu releases apply the referenced kernel package updates that include the corrected library (linux 3.13.0-49.81 or later for 14.04 LTS, linux 4.2.0-16.19 or later for 16.04 LTS, and equivalent packages for aws, gke, hwe, raspi2, snapdragon, and lts variants).

How to confirm the fix worked

Confirm the installed libde265 package version is at or above the fixed release for the distribution; re-test decoding of known trigger files to verify the crash no longer occurs.

Typical attack path

1. Deliver a specially crafted HEVC video file or stream to a target application that links against libde265
2. Trigger decoding or display path that calls display444as420
3. Overflow corrupts heap memory and forces an immediate crash

How to detect it

Review application or system logs for unexpected crashes in processes that call into libde265 around the time of video processing; correlate with inbound video files from untrusted sources.

What your security team should do

• Prioritize patching systems that decode untrusted HEVC content
• Apply the exact fixed kernel packages listed for each Ubuntu release
• Disable or sandbox libde265 usage for external media until updates are deployed